Authentication
Use a personal or team InOneAPI API key, not an upstream provider key or login cookie.
Headers
OpenAI-compatible and file endpoints use Authorization: Bearer $INONEAPI_API_KEY. Messages and count_tokens prefer x-api-key and also accept Bearer; do not supply conflicting keys. Anthropic clients use anthropic-version: 2023-06-01.
curl https://api.inoneapi.com/v1/models \
-H "Authorization: Bearer $INONEAPI_API_KEY"JSON uses Content-Type: application/json. For uploads, let the multipart client set its boundary. App attribution headers are optional.
Personal and team keys
Personal keys check the owner’s wallet balance. Team keys belong to a project and check project status and key/project budgets. Model access, routing, RPM, TPM and concurrency follow current configuration. Do not assume a separate temporary-key type or automatic expiration.
Authorized users can reveal a key again. The server stores an authentication hash and an encrypted secret for authorized reveal, so a “shown only once and unrecoverable” description is incorrect.
Errors and rotation
- 401: missing/invalid key; deleted keys cannot be used.
- 402: insufficient balance, exhausted budget or disabled project for model requests.
- 403: model access denied, or disabled project for file requests.
- 429: rate or route-capacity limit; respect Retry-After when present.
Keep keys out of browser/mobile code, public repositories and logs. Create a replacement, update services, verify migration and delete the old key. Revoke immediately after a leak.